Palo Alto Cortex XDR
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | CortexXDRDataConnector |
| Publisher | Microsoft |
| Used in Solutions | Cortex XDR, Palo Alto Cortex XDR CCP |
| Collection Method | CCF |
| Connector Definition Files | DataConnectorDefinition.json |
| DCR Definition Files | DCR.json, DCR.json |
| CCF Configuration | PollingConfig.json |
| CCF Capabilities | APIKey, Paging, POST |
| Microsoft Learn | View on Learn |
The Palo Alto Cortex XDR data connector allows ingesting logs from the Palo Alto Cortex XDR API into Microsoft Sentinel. The data connector is built on Microsoft Sentinel Codeless Connector Platform. It uses the Palo Alto Cortex XDR API to fetch logs and it supports DCR-based ingestion time transformations that parses the received security data into a custom table so that queries don't need to parse it again, thus resulting in better performance.
Tables Ingested
This connector ingests data into the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
PaloAltoCortexXDR_Alerts_CL |
✓ | ✓ | ✓ |
PaloAltoCortexXDR_Audit_Agent_CL |
✓ | ✓ | ✓ |
PaloAltoCortexXDR_Audit_Management_CL |
✓ | ✓ | ✓ |
PaloAltoCortexXDR_Endpoints_CL |
✓ | ✓ | ✓ |
PaloAltoCortexXDR_Incidents_CL |
✓ | ✓ | ✓ |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions:
- Workspace (Workspace): Read and Write permissions are required.
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
Configuration steps for the Palo Alto Cortex XDR API
Follow the instructions to obtain the credentials. you can also follow this guide to generate API key.
1. Retrieve API URL
1.1. Log in to the Palo Alto Cortex XDR [Management Console] with Admin user credentials 1.2. In the [Management Console], click [Settings] -> [Configurations] 1.3. Under [Integrations] click on [API Keys]. 1.4. In the [Settings] Page click on [Copy API URL] in the top right corner.
2. Retrieve API Token
2.1. Log in to the Palo Alto Cortex XDR [Management Console] with Admin user credentials 2.2. In the [Management Console], click [Settings] -> [Configurations] 2.3. Under [Integrations] click on [API Keys]. 2.4. In the [Settings] Page click on [New Key] in the top right corner. 2.5. Choose security level, role, choose Standard and click on [Generate] 2.6. Copy the API Token, once it generated the [API Token ID] can be found under the ID column
- Base API URL: https://api-example.xdr.au.paloaltonetworks.com
- API Key ID: API ID
- API Token: (password field)
- Click 'Connect' to establish connection
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊